# Tag Info

16

You have clarified the question as asking about whether replacing ShiftRows with a random byte permutation would strengthen AES against differential attacks. It would not. ShiftRows and MixColumns were carefully selected to work in tandem, such that every byte affects every other byte in the state within just two rounds. MixColumns ensures that every ...

9

I assume that you mean the S-box. The answer is NO! Randomly chosen S-boxes are not good choices for differential and linear cryptanalysis. When Biham and Shamir presented differential attacks on DES, one of the things that they showed was that if you replace the S-boxes in DES with randomly chosen ones, then the differential attack becomes much more ...

4

In the case of block ciphers, differential cryptanalysis aim to measure the changes between inputs and outputs with a probability. The goal is to predict what the result will be before the last round and try to extract the key. For hash functions, your aim is to find a second-pre-image. I will take Keccak as an example. It is a sponge construction ...

3

Those tables are fairly easy to build conceptually but require quite some work to actually carry out. Note that: The columns show the XOR for the in-going pairs and the rows show the number of pairs that had the specified XOR afterwards. This pseudo-code generates the table: InLength; // input length of the S-Box in bits OutLengh; // output length of the ...

3

Remark: The round function of your toy cipher is the following. | K ---> + | ------- | S | ------- | >> 2 | Hence in the last round, the shift and S-box are useless (because invertible hence do not add security) which is why in a SPN scheme the key addition at the end is preferred. I did a ...

2

This is the code i used to simulate your Sbox (no intelligence, pure application with lots of mask for security). virtual uint8 apply_s(uint16 input, int numBits) { uint16 mask = 1; for (int i = 1; i < numBits; ++i) { mask |= mask << 1; } uint32 res = input & mask; res = res * res; res = (res >> ...

2

"Not vulnerable" is not how I would describe it, but my understanding is that the existing attacks on DES cannot directly not work with 3DES. At the moment, the best attack against single DES is a linear attack which requires $2^{43}$ plaintext-ciphertext pairs, and has a time complexity of at between $2^{39}$ and $2^{43}$ operations. Linear cryptanalysis ...

2

The key does not effect the cipher' differentials threw the equation (x+k)+(x'+k)=x+x' (the + sign means xor) How you can yes the key is X1+k=x2 And threw the xor k=X1 +x2 X1 is the value beffor the xor with the key value k. X2 is the output of X1+k To make this attack work beffor you must find a differential for the two input pairs threw a chosen ...

Only top voted, non community-wiki answers of a minimum length are eligible